How Desktop Commander MCP Rotates Audit Logs and What claude_tool_call.log Records

Desktop Commander MCP rotates its audit log when the file reaches 10 MiB by renaming it with a timestamp, while each entry records the ISO timestamp, tool name, and JSON arguments.

Desktop Commander MCP maintains a comprehensive audit trail of every internal tool invocation in a dedicated log file. Understanding how these logs are rotated and what specific data they capture is essential for monitoring server activity and debugging tool usage. This article examines the implementation details found in the wonderwhy-er/DesktopCommanderMCP repository, specifically within the src/utils/trackTools.ts file.

What Information Is Recorded in claude_tool_call.log

Log Entry Format

The trackToolCall() function in src/utils/trackTools.ts constructs each audit entry using a strict formatting pattern defined at lines 19‑21. The implementation creates a pipe‑delimited line containing three distinct fields to ensure consistent parsing and human readability.

Captured Data Fields

Every entry written to claudetoolcall.log (the file path defined by the TOOL_CALL_FILE constant) contains the following components:

• ISO‑8601 timestamp – The exact moment the tool was invoked, recorded in UTC.
• Tool name – The identifier of the invoked tool, padded to 20 characters for vertical alignment.
• Arguments – A JSON‑stringified representation of the parameters passed to the tool, or an empty field if no arguments were provided.

2026-07-29T14:23:07.123Z | list-files           |
2026-07-29T14:24:12.456Z | open-file            | Arguments: {"path":"/home/user/report.pdf","mode":"read"}

How Audit Log Rotation Works in Desktop Commander MCP

The 10 MiB Size Threshold

Audit log rotation is triggered by file size rather than time. The system checks the current size of claudetoolcall.log against the TOOL_CALL_FILE_MAX_SIZE constant (set to 10 MiB) before each write operation. When the log exceeds this threshold, the rotation mechanism activates to prevent unbounded disk usage.

Timestamped Archive Process

The rotation logic is implemented at lines 32‑45 of src/utils/trackTools.ts. The process follows three distinct steps:

1. Generate Archive Name – The code creates a timestamp suffix using the format YYYY-MM-DD_HH-MM-SS (lines 38‑42).
2. Rename Existing Log – The current claudetoolcall.log file is renamed to claudetoolcall_YYYYMMDD_HH-MM-SS.log (lines 44‑45).
3. Initialize New Log – A fresh claudetoolcall.log file is created, and the new audit entry is appended to it (lines 47‑48).

This size‑based rotation ensures that audit history is preserved in timestamped archives while the active log remains manageable.

Implementation Details in trackTools.ts

The entire audit system centers on the trackToolCall() utility function exported from src/utils/trackTools.ts. This asynchronous function accepts the tool name and an optional arguments object, formats them according to the specification, and handles the file I/O including rotation checks.

import { trackToolCall } from './utils/trackTools.js';

// Log a tool call without arguments
await trackToolCall('list-files');

// Log a tool call with parameters
await trackToolCall('open-file', { path: '/home/user/report.pdf', mode: 'read' });

When the log file approaches the 10 MiB limit, the rotation code automatically produces archived files such as claudetoolcall_2026-07-29_14-30-00.log, allowing administrators to maintain a complete historical record without impacting runtime performance.

Summary

• Log Location: Audit entries are stored in claudetoolcall.log, defined by the TOOL_CALL_FILE constant.
• Entry Format: Each line contains an ISO timestamp, a 20‑character padded tool name, and optional JSON arguments.
• Rotation Trigger: Files are rotated when they exceed 10 MiB (TOOL_CALL_FILE_MAX_SIZE).
• Rotation Method: The current log is renamed with a timestamp suffix, and a new log file is created.
• Source File: All logic resides in src/utils/trackTools.ts, specifically in the trackToolCall() function.

Frequently Asked Questions

What file size triggers audit log rotation in Desktop Commander MCP?

Rotation occurs when claudetoolcall.log reaches 10 MiB. This threshold is defined by the TOOL_CALL_FILE_MAX_SIZE constant, which the system checks before appending each new entry in src/utils/trackTools.ts.

Where does Desktop Commander MCP store its audit log entries?

The audit log is stored in a file named claudetoolcall.log (as specified by the TOOL_CALL_FILE constant) within the project’s working directory. The specific path is resolved relative to the server’s execution context.

What specific data does each line in claude_tool_call.log contain?

Each line records three pieces of information: the ISO‑8601 timestamp of the invocation, the tool name padded to 20 characters, and the JSON‑stringified arguments (prefixed with "Arguments: "). If no arguments are provided, the field remains empty.

How can I programmatically track tool calls in Desktop Commander MCP?

Import the trackToolCall() function from src/utils/trackTools.ts and await it with the tool name as the first argument. Optionally pass a parameters object as the second argument to record the specific inputs provided to the tool.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}